Yep, they release a periodical PDF with interim updates [1]. Only the most lazy "security researcher" would believe that Windows only trusts two dozen root certificates.

[1]: http://social.technet.microsoft.com/wiki/contents/articles/1...